# CVE-2026-56136: NTFS-3G out-of-bounds read in ntfs_ir_nill()

Source: https://junglewise.ai/threats/cve-2026-56136-ntfs-3g-out-of-bounds-read-in-ntfs-ir-nill  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56136 · Severity: medium · CVSS 4.7 · Published 2026-08-24

NTFS-3G is an open-source driver that enables Linux systems to read and write NTFS filesystems (commonly found on Windows drives). An attacker can craft a malicious NTFS disk image that, when mounted or accessed by NTFS-3G, triggers an out-of-bounds memory read. This allows the attacker to read sensitive information from the NTFS-3G process, such as encryption keys or other confidential data in memory.

Technologies: [Tuxera NTFS-3G](https://junglewise.ai/threats/technologies/ntfs-3g). Vendors: [Tuxera](https://junglewise.ai/threats/vendors/tuxera).

## Quick answers

**Is CVE-2026-56136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56136 being exploited in the wild.

**How severe is CVE-2026-56136?** Medium severity, with a CVSS score of 4.7, published 24 August 2026.

**Which products and versions are affected?** Tuxera NTFS-3G through 2026.2.25.

**Is there a fix for CVE-2026-56136?** A patch was published on 2026-07-07: Version 2026.7.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56136 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-56136?** Check whether you run Tuxera NTFS-3G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an out-of-bounds read in the ntfs_ir_nill() function within libntfs-3g/index.c. The flaw is triggered when NTFS-3G processes a file with a specially crafted name on a malicious NTFS disk image. The vulnerability requires local access and a user to mount or interact with the malicious filesystem. An attacker can read arbitrary data from the NTFS-3G process memory without authentication. The issue has been patched in version 2026.7.7, with backports available for earlier versions including 2022.10.3.

## Affected products

- Tuxera NTFS-3G through 2026.2.25

## Timeline

- 2026-07-15: disclosed
- 2026-07-07: patched: Version 2026.7.7 released

## References

- [https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95](https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95)

## Related threats

- [NTFS-3G heap buffer overflow in ntfscat](https://junglewise.ai/threats/cve-2026-42616-in-ntfs-3g-before-2026-7-7-a-heap-buffer-overflow-exists-in-cat)
- [NTFS-3G heap buffer overflow in build_inherited_id()](https://junglewise.ai/threats/cve-2026-56135-ntfs-3g-heap-buffer-overflow-in-build-inherited-id)